The Sprint POPI states that Security awareness training will be provided to new users prior to their being granted access to sensitive information assets.
Security training is a vital element of the Sprint Networx security program. Personnel must be properly trained in order to implement an effective Networx security program that addresses all potential risks. The Sprint security training program provides both formal and informal instruction for personnel associated with the Networx program. The remainder of this Section discusses the Security Awareness and Training Program.
The following methods will be used for presentation of security awareness training:
• Computer Based Training (CBTs)
• Printed flyers, brochures, and bulletins
• Electronic mail messages
• Posters
• Informal presentations
• Formal training classes
• Newsletter articles
3.8.1 Training Curriculum
Sprint Corporate Security oversees, maintains, and administers the Networx security-training program. This program, which is in accordance with the Sprint Corporate Training Program, focuses on ensuring that the Networx operations staff is able to apply security concepts while performing the tasks relative to their particular positions. Within the Networx program, there are three distinct information systems security-training categories:
(1) General awareness and training,
(2) Information system specific training, and (3) Professionalization training.
The following paragraphs discuss each of these various training categories.
3.8.2 General Awareness and Training
General Awareness and Training is provided in a 90 minute presentation which affords all Networx personnel with an understanding of:
• Government and Networx policy and goals for protecting information and information systems,
• The roles and responsibilities of the various Networx security staff personnel, and
• The relationship between information systems security and other security disciplines.
The Networx General Awareness and Training program will be conducted throughout the contract period. Within this program, there are three types of training:
• Initial - All newly assigned Networx personnel receive initial General Awareness and security training prior to being granted access to any Networx information.
• Periodic - All Networx personnel will receive additional General Awareness and Training on an annual basis.
• Refresher - Refresher security training is provided, as needed, when there has been a change in security requirements.
Additionally, the Sprint Security Event Management Team subscribes to many
government, academia, and commercial security response organizations that provide near real time security alert media, vulnerabilities and hoaxes. Each security alert/warning is evaluated by the Networx ISSO who disseminates the appropriate information along with other information such as the National Information Protection Center (NIPC) warnings from the FBI. These ad hoc security announcements grant general awareness and training sensitization of the Networx personnel to the existence of potential threats and vulnerabilities associated with the use of information systems. Near real time security
alerts/warnings and training also heightens awareness of the need to protect data, information, and information system assets.
3.8.3 Information System Specific Training
Networx personnel also receive security training on each specific system to which they have access. This training provides Networx operational personnel with a clear
understanding of the threats to and vulnerabilities of the system. In general, information system specific training includes a definition of terms, a discussion of the major
categories of threats (e.g., unauthorized accidental or intentional disclosure, modification, destruction, or delay), a discussion of threat impact areas, common examples of computer abuse, and examples of common system vulnerabilities.
The Information System Specific Training program will be conducted throughout the contract period. Within this program, there are three types of training:
• Initial - All newly assigned Networx personnel receive initial Information System Specific training prior to being granted access to any Networx information system.
• Periodic - All Networx operational personnel will receive additional Information System Specific training on an annual basis.
• Refresher - Refresher security training is provided, as needed, when there has been a change in the system, system rules, or user procedures.
3.8.4 Professionalization Training
Networx Professionalization training is primarily aimed at the security staff and provides the skills necessary to evaluate computer security procedures and practices.
Professionalization training ensures that the Networx security staff is able to apply security concepts while performing the tasks that relate to their particular positions. This training is given in addition to the training General Awareness and Information System Specific training discussed above.
To ensure that the Networx ISSO is knowledgeable on current Federal policies, this individual is continuously trained or updated by On the Job training in the following areas:
• Computer security basics;
• Good computer security practices;
• Roles of various organizations in ensuring adequate security and safety of Networx information and information system resources;
• Basic concepts of risk management;
• Security planning;
• Auditing and monitoring;
• Information system security disciplines;
• Contingency planning; and
• Life-cycle security management.
Additionally, the Networx ISSO is trained on specific local security policies, requirements, and procedures.
Depending upon the particular training topic, Networx Security Professionalization training may be conducted by Sprint Corporate Security, the Sprint Corporate Training Organization, or through Government-sponsored security training programs. When appropriate, Sprint augments its training program with Government-sponsored courses.
3.8.5 Individualized Training Programs for Operations Personnel
All Networx personnel will receive initial general security awareness training, annual periodic updates, and refresher training (as appropriate). In addition, each individual supporting the Networx program will receive a security-training program specifically tailored to their specific job function. The degree and depth of training that is provided to each Networx staff member is dependent upon the requirements of their position and the individual’s level of expertise.
3.8.6 Security Awareness for Government Users
Sprint will deliver security awareness training material to Government users by including the material in our various training courses. This will help ensure Government users are receiving the information they need and will maximize their training effort.
Sprint will work with the Government and subscribing Agencies post-award to define a security awareness program that will meet the individual needs of the Agencies. This will help ensure that the Government and Agency users are receiving the specific security awareness information that they need, as well as ensuring the Sprint program aligns with those provided by the Government to meet its FISMA obligations.
In general, Sprint will provide and maintain security awareness as it relates to those information systems and services with which Government users interact. We will provide security awareness training by utilizing a mix of the following approaches as agreed upon with the Government and subscribing Agencies.
• Computer-based training
• Flyers, brochures, bulletins
• Presentations
• Other mutually agreed upon approaches and/or media
By including security awareness training material in our Government training classes, Sprint ensures that Government users receive the information they need without having to take additional training classes. And by working with the Government to customize our security awareness training where applicable. Sprint also ensures that our materials compliment the security awareness and training material provided by the Government to its employees and contractors, ensuring an effective overall approach to security
awareness and training. (J.9 ID 10181)
3.8.7 Security Awareness for Sprint Networx Partners
Sprint takes several different approaches to ensure a high level of security awareness in the associates of our Networx partners. The use of multiple approaches provides us with the most flexible means of providing security awareness training, thus we can ensure an approach is the most cost-effective means for a given partner.
Our first approach is to meet with our partners and review their own security awareness training program. We compare it to the Networx Security Awareness Training program Sprint provides to our associates and note any differences. The differences are reviewed and analyzed, and any items that may be lacking in our partners’ programs are noted. We then ask that they update their program to include the information to ensure consistency between our program and theirs.
After defining the security awareness program, we then work with our partner to define the criteria for verifying that an associate successfully completed the training (e.g., post assessment, instructor verification, etc.) Finally, we require them to provide at least yearly (more often as necessary) certification that all of their associates working on Networx-related products and/or services have successfully completed their security awareness training program. Each of these requirements is included in the Statement of Work for the partner.
If, during discussions with one of our partners, we determine that they have not implemented a security awareness training program, we take one of two approaches, which are described below:
• In Approach 1, we provide the partner the option of defining, designing, and implementing their own Networx security awareness training program. The Sprint Corporate Security Team provides guidance to the partner as they design their security awareness training program to ensure it covers all topics of information security. This helps ensure consistency in the materials presented across the Networx program, but also allows the partner flexibility in designing a solution that can be used across their organization.
• In Approach 2, we provide the partner the option of utilizing the Sprint Networx security awareness training program. We work with our partners to determine the best approach to administering the materials to their associates and for verifying their completion of the materials.
A final approach we use is a hybrid of those described above. If there are cases where we find that a partner has a defined security awareness training program but that it lacks Government-related information, we determine how to fill that gap. The hybrid approach uses the partner’s established security awareness training capability, but Sprint provides supplemental information to cover the Government-specific areas. Typically this
information is provided via a flyer, either electronically or hard copy, to the partner’s associates.
Sprint uses the most flexible and cost-effective approaches to ensure a high level of security awareness in our Networx partners. This flexibility helps ensure the Government
that our partners’ associates are doing everything possible to ensure the security of our Networx customers’ information and services. (J.9 ID 10181)